> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Kerberos Double Hop Problem

The Kerberos **double hop problem** shows up when connecting to a remote server via PowerShell Remoting/WinRM (hop 1) and then trying to use that session to reach a *third* server (hop 2). By default, Windows won't forward the credentials used for hop 1 onward to hop 2, so whatever runs on the third server fails to authenticate, even though the identity looks right.

> [!NOTE]
>
> This bites [Pass-the-Ticket](https://0-x.dev/lateral-movement/pass-the-ticket.md) workflows specifically: a TGT that authenticates fine to the first host doesn't automatically authenticates to the second host.

***

## Workaround #1: PSCredential Object

Explicitly creates a credential object inside the session and passes it directly to the next command, giving that command the exact identity it needs for the second hop without relying on delegation at all.

```powershell theme={null}
# Create PSCredential Obj
$SecPassword = ConvertTo-SecureString '!qazXSW@' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('INLANEFREIGHT\backupadm', $SecPassword)

# Pass PSCredential Obj
Get-DomainUser -SPN -Credential $Cred | Select-Object samaccountname
```

## Workaround #2: Register PSSession Configuration

Registers a persistent, custom endpoint on the remote server that always executes commands under a specific *RunAs* security context, so the double-hop never needs to happen in the first place.

```powershell theme={null}
# Open a normal WinRM session
Enter-PSSession -ComputerName ACADEMY-AEN-DEV01.INLANEFREIGHT.LOCAL -Credential inlanefreight\backupadm

# Register a new PSSession config on the target, bound to that account
Register-PSSessionConfiguration -Name backupadmsess -RunAsCredential inlanefreight\backupadm

# Restart the service so the new config takes effect
Restart-Service WinRM
```

***

## Quick Reference Tools

> **[Pass-the-Ticket](https://0-x.dev/lateral-movement/pass-the-ticket.md)**
>
> The ticket-reuse workflow that most often runs into this problem.

> **[Remote Access & Execution](https://0-x.dev/lateral-movement/remote-access.md)**
>
> The `Enter-PSSession` baseline this problem builds on.

> **[slayerlabs: Double Hop](https://posts.slayerlabs.com/double-hop/)**
>
> Deeper write-up covering further solutions (CredSSP, Kerberos unconstrained/constrained delegation).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.